Privacy Notice
This notice explains what personal data Dxred Technologies Private Limited, which operates the Optiploy service ("Optiploy", "we") collects, why, who sees it, how long we keep it and what choices you have. It applies to our website and platform. We act as the data controller (under GDPR and UK GDPR) and the data fiduciary (under India's DPDP Act 2023).
1. Data we collect
| Category | Examples | Who it is about |
|---|---|---|
| Account data | Name, email, password hash, role, company | Everyone with an account |
| Profile data | Headline, products, experience, certifications, rate, availability, location | Talent |
| Verification data | Government ID, liveness check results, certification checks | Talent |
| Engagement data | Requirements, proposals, contracts, timesheets, approvals, messages | Clients and Talent |
| Usage and device data | Pages visited, device and browser type, IP address, cookie identifiers | Visitors and users |
| Communications | Messages to us, form submissions, support requests | Anyone who contacts us |
We collect most of this from you directly. We also receive some from our verification provider, certification bodies you ask us to check, and from the company or professional on the other side of an engagement. We do not ask for more than we need, and we do not knowingly collect special-category or sensitive data beyond identity documents needed for verification.
2. Why we use it, and our legal basis
| Purpose | Basis (GDPR / UK GDPR) | Basis (DPDP) |
|---|---|---|
| Create and run your account | Contract | Consent or legitimate use |
| Verify identity and skills, and match assignments | Contract; legitimate interests | Consent |
| Run engagements, timesheets, invoices and payouts | Contract; legal obligation | Legitimate use; consent |
| Keep the platform safe, prevent fraud and enforce our rules | Legitimate interests; legal obligation | Legitimate use |
| Respond to enquiries and send service messages | Contract; legitimate interests | Consent or legitimate use |
| Send marketing you opted into | Consent | Consent |
| Analytics and improving the site, where you allow it | Consent | Consent |
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing done before, and may mean we can no longer provide part of the service.
3. Who we share data with
We do not sell your personal data. We share it only as needed:
- The other party in an engagement. Clients see the profile information Talent put forward for an assignment; Talent see the company and requirement details.
- Service providers acting for us, such as hosting, identity verification (Veriff), email and support, analytics where you allow it, and professional advisers. They may use data only on our instructions.
- Authorities and legal needs, where the law requires it or to protect rights, safety or the platform.
- A business transfer, such as a merger or sale, with notice to you where required.
4. International transfers
We host data in the EU (EU West, Amsterdam, Netherlands) and our team and providers may access it from other countries, including India. Where data moves out of the EU or UK, we use approved safeguards such as standard contractual clauses, or another lawful transfer mechanism. Under the DPDP Act, we transfer data only to countries that the Government of India has not restricted. To get a copy of the safeguards we rely on, such as the standard contractual clauses (with commercial terms removed), write to privacy@optiploy.com.
5. How long we keep data
We keep data only as long as needed for the purpose, to meet legal, tax and accounting duties, and to handle disputes. Typical periods: account and profile data while your account is active and for 3 years after it closes, to handle claims; verification records for 1 year after your account closes; contracts, timesheets and invoices for 8 years, as Indian company and tax law requires; marketing preferences until you withdraw consent; and system logs for at least 1 year, as the DPDP Rules require. We then delete or anonymise it. [Counsel to confirm retention periods.]
6. Security
We protect data with encryption in transit and at rest, multi-factor and single sign-on options, access controls limited to staff who need access, and monitoring. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
7. Your rights
Where the law applies to you, you can ask us to:
- Access the personal data we hold about you and get a copy.
- Correct inaccurate or incomplete data.
- Delete your data, subject to legal duties to keep some of it.
- Restrict or object to certain processing, and ask for portability of data you gave us (GDPR and UK GDPR).
- Withdraw consent at any time.
- Nominate someone to exercise your rights if you die or cannot (DPDP).
- Opt out of sale or sharing and limit use of sensitive data (California). We do not sell or share personal data for cross-context behavioural advertising, and we do not discriminate against you for using your rights.
To use a right, write to privacy@optiploy.com. We may need to verify who you are, and we will reply within the time the law sets: generally one month under GDPR and UK GDPR, 45 days under CCPA/CPRA, and the period set by the DPDP Rules. You can also complain to your data protection authority: the Data Protection Board of India, your EU supervisory authority, the UK ICO, or the California Privacy Protection Agency.
8. Cookies and similar technologies
We use necessary cookies to make the site work. We use preference, statistics and marketing cookies only if you accept them in the cookie banner, and you can change your choice any time through Cookie settings in the footer. The cookies we use, their purpose and how long they last are listed below.
| Type | Purpose | Examples | Lifetime |
|---|---|---|---|
| Necessary | Keep the site working and remember your cookie choice | [cookie names] | [session / duration] |
| Preferences | Remember settings such as language | [cookie names] | [duration] |
| Statistics | Understand how the site is used, only if you accept | [analytics provider and cookie names] | [duration] |
| Marketing | Measure campaigns, only if you accept | [provider and cookie names] | [duration] |
9. Children
Optiploy is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
10. Automated matching
We rank assignments and Talent using profile data such as products, versions, seniority, rate and availability. This is a tool to help people decide. It does not by itself make a legal decision about you. You can ask us for a human review of a matching outcome.
11. Third-party sites
Our site may link to other sites. We are not responsible for their privacy practices.
12. Changes to this notice
We will post any update here with a new effective date and tell you about material changes.
13. Contact and grievances
Data controller: Dxred Technologies Private Limited, 2401, Tridev Tower-1, Bhakti Marg, Near Vardhman Nagar, Mulund West, Mumbai, Maharashtra, India – 400080. Privacy contact: privacy@optiploy.com. Grievance Officer (India): Nirav Dedhiya, grievance@optiploy.com. Data Protection Officer or EU/UK representative: none appointed.